Science Daily reports: Researchers showed that unencrypted signals routinely exchanged between WiFi devices and routers can be used to create radio-based images of people and recognize them within seconds. In tests involving 197 participants, the system identified individuals with nearly 100% accuracy, even from different angles and regardless of how they walked. "By observing the propagation of radio waves, we can create an image of the surroundings and of persons who are present," says Professor Thorsten Strufe from KASTEL, KIT's Institute of Information Security and Dependability. "This works similar to a normal camera, the difference being that in our case, radio waves instead of light waves are used for the recognition," explains the cybersecurity expert. Because the technique analyzes radio waves moving through a space, a person does not need to have a phone, smartwatch, or other WiFi enabled device with them. "Thus, it does not matter whether you carry a WiFi device on you or not." Even turning off your own device would not necessarily prevent the system from working. "It's sufficient that other WiFi devices in your surroundings are active...." Connected devices routinely send information back to the router to help optimize wireless communication. These signals, known as beamforming feedback information (BFI), are transmitted without encryption, meaning that anyone within range can potentially read them. By analyzing that information, the system can generate images of people from multiple viewpoints. Those images can then be used to determine a person's identity. Once the machine learning model has already been trained to recognize individuals, the identification process takes only a few seconds.

Read more of this story at Slashdot.

An anonymous reader quotes a report from Ars Technica: On Monday, passengers aboard Delta flight 591 going from Las Vegas to Atlanta allegedly spoofed the onboard Wi-Fi, raising the attention of federal law enforcement. The incident came one day after the DEF CON security conference concluded in Las Vegas, and was first described on social media accounts that follow publicly available air-to-ground messages, known as ACARS. According to the "ACARS Drama" account, a message was sent by pilots from the plane stated: "NO INFO AS OF NOW WE HAVE A BUNCH OF PAX THAT WERE AT A CYBER CONFERENCE IN LAS THEY WERE ABLE TO JAM OUR WIFI AND BROADCAST THEIR SIGNAL." A description of the incident posted to Reddit further stated that these passengers created a fake hotspot ("Delta WiFi Fast"), with a phishing landing page "designed to harvest passengers' personal credentials." This technique, sometimes known as an "evil twin" attack, has been long-known to the IT security community. It involves setting up a fake Wi-Fi network and then capturing login credentials and other data. "One initial finding is an unauthorized WiFi network, which was not provided, operated, or supplied by Delta, was present onboard the aircraft for a short time during the flight," said a Delta spokesperson. Delta further noted that the flight's safety was "never in question and no aircraft operating systems were affected," and that no emergency was declared. Ars notes that the "actual onboard Wi-Fi was disabled for 30 minutes."

Read more of this story at Slashdot.